{"id":"CVE-2023-20273","kind":"vulnerability","aliases":["CVE-2023-20273"],"related":[],"title":"A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to…","description":"Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.\n\nCISA required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","summary":"Cisco IOS XE's web user interface has a command injection flaw that lets an attacker run commands on the device. Chained with CVE-2023-20198, an attacker creates a local admin account, escalates to root, and writes a persistent implant to the file system.","severity":"critical","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2023-10-23T00:00:00+00:00","products":[{"name":"Cisco Cisco IOS XE Web UI","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.1.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.1.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.1.3","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.2.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.2.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.1a","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.3","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.4","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.5","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.5b","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.6","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.7","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.8","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.9","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.10","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.3.11","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.4.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.4.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.4.3","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.5.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.5.1a","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.5.1b","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.5.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.5.3","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.2","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.3","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.4","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.4a","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.5","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.5a","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.6","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.7","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.8","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.9","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.6.10","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.7.1","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.7.1a","ecosystem":"vendor"},{"name":"cisco ios xe","fixed":[],"affected":"= 16.7.1b","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","ios-xe","network-devices","self-hosted"],"not_affected_if":["no-internet-exposure","web-ui-disabled"],"how_to_check":null,"fix":"Follow Cisco's vendor advisory for CVE-2023-20273 and apply the listed fixed release or mitigation; CISA BOD 23-02 applies to federal agencies.\nIf the web UI was exposed to the internet or untrusted networks, follow vendor instructions to check for compromise and report positive findings to CISA.","status":"open","published_at":"2023-10-23T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:22+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:04:22Z","model":"claude-haiku-5-5","output":{"fix":"Follow Cisco's vendor advisory for CVE-2023-20273 and apply the listed fixed release or mitigation; CISA BOD 23-02 applies to federal agencies.\nIf the web UI was exposed to the internet or untrusted networks, follow vendor instructions to check for compromise and report positive findings to CISA.","reach":"internet","impact":"high","summary":"Cisco IOS XE's web user interface has a command injection flaw that lets an attacker run commands on the device. Chained with CVE-2023-20198, an attacker creates a local admin account, escalates to root, and writes a persistent implant to the file system.","category":"infrastructure","who_cares":["cisco","ios-xe","network-devices","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker gets root on the device and installs a persistent implant","analyst_note":"Sources do not give affected or fixed versions or detection steps; check Cisco's advisory for CVE-2023-20273 and the CISA KEV entry for version and compromise-check details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["web-ui-disabled","no-internet-exposure"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000527,"input_tokens":3004,"output_tokens":454,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-02':298C '-1435':263C '-20198':188B,226C '-2021':262C '-2023':20A,23A,187B,225C,251C '-20273':21A,24A,252C '23':297C 'account':195B 'action':282C 'activ':279C 'admin':194B 'affect':306C 'allow':14A 'appli':300C 'associ':265C 'attack':18A,178B,190B,228C 'authent':16A 'believ':273C 'bod':296C 'chain':184B,222C 'cisa':280C,339C 'cisco':9A,25A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,103A,106A,109A,112A,115A,118A,121A,124A,127A,130A,133A,136A,139A,142A,145A,148A,151B,163B,208C,248C,287C,308C 'command':172B,180B,213C 'complianc':294C 'compromis':332C 'contain':211C 'could':13A 'creat':191B 'cve':19A,22A,186B,224C,250C,261C 'deploy':258C 'determin':325C 'devic':159B,183B 'elev':236C 'escal':196B 'event':269C 'exploit':152B,256C,268C 'expos':313C 'featur':7A 'file':206B,246C 'find':337C 'flaw':174B 'follow':321C 'host':162B 'identifi':249C 'immedi':334C 'implant':203B,243C,260C 'infrastructur':153B 'inject':173B,214C 'instanc':285C 'instruct':304C,323C 'interfac':169B,220C 'internet':316C 'io':10A,155B,164B,209C,288C,309C 'ios':27A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,104A,107A,110A,113A,116A,119A,122A,125A,128A,131A,134A,137A,140A,143A,146A,149A 'ios-x':154B 'let':176B 'leverag':230C 'local':193B,233C 'longer':272C 'may':329C 'mitig':301C 'network':158B,320C 'network-devic':157B 'new':232C 'per':302C 'persist':202B 'posit':336C 'previous':264C 'privileg':237C 'product':307C 'relat':276C 'remot':17A 'report':335C 'requir':281C 'root':198B,239C 'run':179B 'self':161B 'self-host':160B 'softwar':12A 'system':207B,247C,328C 'ui':6A,30A,291C,312C 'untrust':319C 'user':168B,219C,234C 'vendor':303C,322C 'verifi':283C 'vulner':2A,215C,255C 'web':5A,29A,167B,218C,290C,311C 'write':200B,241C 'xe':11A,28A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,102A,105A,108A,111A,114A,117A,120A,123A,126A,129A,132A,135A,138A,141A,144A,147A,150A,156B,165B,210C,289C,310C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-23T00:00:00+00:00","kev":{"dateAdded":"2023-10-23","dueDate":"2023-10-27","requiredAction":"Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-20273","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-20273","severity":null,"published_at":"2023-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-20273","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20273","severity":null,"published_at":"2023-10-25T18:17:23+00:00","modified_at":"2026-06-17T05:30:12+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}